Skip to main content

Cabinet Office Assessment (Documents)

Volume 477: debated on Thursday 12 June 2008

With permission, I would like to make a statement about events relating to the loss and recovery of two Joint Intelligence Committee documents.

The Joint Intelligence Committee, which is situated in the Cabinet Office under the chairmanship of Alex Allan, provides intelligence assessments to Departments across Government. An employee working in the JIC assessment staff left two documents on an early-morning commuter train on Tuesday of this week. Although the documents do not contain the names of individual sources or specific operational details, they are sensitive high-level intelligence assessments. The individual concerned informed his superiors about the loss of the documents on Wednesday morning and they called in the Metropolitan police who began an urgent investigation.

On Wednesday afternoon, the Cabinet Office was contacted by the BBC, which told the Department that the two documents were in its possession. The nature of the documents was made clear to the BBC and it was requested that it did not broadcast the contents of the documents, and that they be returned. The original documents were handed back to the Metropolitan police on Wednesday evening. There is no evidence at this stage to suggest that our vital national security interests have been damaged or that any individuals or operations have been put at risk. However, the police investigation is continuing.

This was a clear breach of well-established security rules that forbid the removal of documents of this kind outside secure Government premises without clear authorisation and compliance with special security procedures. These rules are a clear part of the operating procedures for handling matters of this sensitivity. All individuals on joining the assessment staff are given a formal briefing on the rules by a specially designated security officer. That formal briefing is supplemented by clear, written instructions provided to the individual, who has to sign a statement to indicate that they have read, understood and will comply at all times with the rules.

In this case, no authorisation was sought for the removal of the documents. The official concerned has been suspended from his duties as part of a standard civil service disciplinary procedure. The chairman of the JIC, Alex Allan, has confirmed that there are clear rules and that they were not followed in this case. But in order to provide the reassurance that all necessary procedures and safeguards are in place, the Cabinet Secretary has asked Sir David Omand, former permanent secretary for security and intelligence, and former permanent secretary at the Home Office, to carry out a full investigation of the circumstances of the case.

Given the nature of the issues, I have asked Sir David to keep the Intelligence and Security Committee, which has a particular role in security and intelligence issues, fully informed. All JIC staff have been reminded by the chairman of the JIC of the fundamental importance of following all security procedures in full, and similar steps are being taken across government for those handling sensitive, intelligence-related material.

It is a matter of utmost concern to the Government that this breach of security has happened. We will take all steps to ensure that all individuals who work within the Joint Intelligence Committee staff observe the procedures that are necessary for security. We will continue to do everything necessary to safeguard sensitive intelligence material so that we safeguard the British national interest. I commend this statement to the House.

The Minister was absolutely right to come to the House at the earliest opportunity to make a statement, and I am grateful for sight of that statement.

The Prime Minister said yesterday that we should take no risks with national security. There can be few greater risks than the casual abandonment of top secret intelligence material on a train, posing obvious risks both to national security and potentially to the safety of our armed forces personnel. There can scarcely have been a graver breach of intelligence and security procedures than this case. That al-Qaeda do not today know precisely what Britain knows about its activities and, more importantly, what Britain does not know, is entirely due to the responsible way in which the BBC has behaved, and reflects no credit whatsoever on the Government.

This lamentable lapse of basic security awareness and procedures raises a number of specific questions for the Minister for the Cabinet Office, and I would be grateful if he would respond to them. How quickly did the BBC alert the Cabinet Office to the loss? We assume that it was almost immediately, but I would be grateful for confirmation of that. When was he personally aware of the problem? When did he inform the Prime Minister of the problem? What steps were taken immediately when the loss of the file was known on Tuesday?

Were these two documents the original, numbered copies of the document—obviously, it would have been a breach of procedures for them to be allowed out of the Department in such circumstances—or were they illegal photocopies made in breach of the established existing procedures? What reason could there possibly be for this official to remove such files, apparently to read on the train? Why, now that such powerful encryption is available, are documents of such an extremely high level of security printed on paper at all? It may be too early for the Minister to say this, but he may be able to give some indication: will anybody be prosecuted under the Official Secrets Act? Was he aware of there being a problem with information security in the relevant part of his Department, in the JIC, before the incident?

There is clearly a major systemic problem with data security at the heart of the Government, and the saga goes on. In November last year, Her Majesty’s Revenue and Customs lost 15,000 records of Standard Life customers, followed by the loss of 25 million data records. In December, 18,000 personal records from the Department for Work and Pensions were found at a contractor’s home. In December, the Secretary of State for Transport admitted that 3 million driver records were lost, apparently in Iowa. Also in December, NHS trusts lost 168,000 confidential records. The Ministry of Defence lost three laptops, stolen from the boot of a Navy officer’s car, containing sensitive personal details of no fewer than 600,000 people. In January, hundreds of DWP records had apparently been dumped on a roundabout in Devon.

It is not as if there had not been forewarning of the risks. Two years ago, the Walport report called for the Government to improve data security, warning that leaks of personal data would damage the Government’s reputation. More than a year ago, in February 2007, General Sir Edmund Burton, the Cabinet Office’s own adviser on information assurance, said:

“What keeps me awake at night is that, with some notable exceptions, across government there’s too little awareness of the scale and breadth of the risk facing us at the moment”.

Just last summer, at about the time when the Chancellor assumed his current responsibilities, Lord Coleman raised concerns in his report on data security, saying

“adequate mechanisms are not yet in place”.

Obvious and dangerous issues arise from this kind of failure to comply with basic procedures, and the fact is that there may be—I should be grateful for the Minister’s comments about this—a real problem with civil service morale, leading to laxity in the way in which procedures are not complied with.

The Cabinet Office has responsibility for information security across the whole Government, and the Minister for the Cabinet Office is its ministerial head. I am sorry to have to say that there is no evidence that he takes this crucial part of his responsibilities nearly seriously enough. When we have asked questions in the past, he has allowed his junior Ministers to reply on this crucial issue. It is clear that he did not even read the Coleman report when it was published last summer. Does he understand that he must himself take very direct personal responsibility for this latest shocking failure at the heart of his own Department? Ministers cheerfully claim credit for anything good that happens, but all the failures are someone else’s fault. Does the Minister understand that this buck really does stop with him?

My reason for coming to the House at the earliest opportunity was precisely to inform it of what I know about this serious situation, and, indeed, to take responsibility on behalf of the Government for sorting it out.

Let me deal with the questions asked by the right hon. Member for Horsham (Mr. Maude). Some, obviously, will be the subject of the continuing investigation by the police, and also the investigation by Sir David Omand.

The right hon. Gentleman asked when I was informed, and when the Prime Minister was informed. We were both informed yesterday afternoon. Then, fairly quickly, I spoke to Alex Allan, the chairman of the Joint Intelligence Committee. The right hon. Gentleman also asked whether the copies of the documents that were returned were the original copies. They were, but obviously the police will investigate the question of the originals and how they found their way from the train where they were lost on Tuesday to the BBC.

Why did the individual concerned remove the documents? That is and should be a matter for the current investigations, but, as I have said, I think that it is an important point. There was a clear breach not simply of the rules, but of rules to which people sign up when they join the assessment staff.

The right hon. Gentleman asked why copies of such documents were provided. A very small number of copies are provided, some of them for people who attend JIC meetings. As the right hon. Gentleman knows, information security of all kinds is not without its risks, although I take his point about the need to minimise the number of documents that are produced.

Obviously I shall not go into the details of any prosecutions or any other action that is to be taken. That is a matter for the police.

The right hon. Gentleman asked whether I was aware of any problems relating to the work of the JIC. I think that the JIC does an extremely good job for our country, and I was not aware of any problems.

There were clear rules in this case. I have set out those rules, and the way in which people sign up to them when they go to work for the assessment staff. This is a case in which those rules were not followed, and it is a matter of deep regret that they were not followed. As I have said, the rules are in place; but to provide the necessary reassurance, we have asked Sir David Omand to consider whether any more can be done to provide the necessary safeguards. We will of course await the outcome of his investigation.

I think that the right hon. Gentleman’s point about civil service morale was slightly beneath him. Civil servants do an extraordinary job, particularly in the intelligence services. I do not believe that that is the reason why the documents were left on a train.

I hope that the right hon. Gentleman will help us to ensure that we can have the information security that we need.

I am grateful to my right hon. Friend for coming to the House at the earliest opportunity. When issues of this kind arise, Ministers ought to make themselves available to answer questions in the House. However, I am somewhat concerned about one part of my right hon. Friend’s statement. He said there was “a clear breach of well-established security rules that forbid the removal of documents of this kind outside secure Government premises”. Members of the House of Commons who serve on the Intelligence and Security Committee have to go to the Cabinet Office to read the documents there. They may not be removed. Why on earth does someone who works in the Cabinet Office need to remove documents at all?

My right hon. Friend has raised an important point. I can tell him that there are circumstances in which people must have meetings outside secure premises and documents need to be transferred from one place to another, but the most stringent rules exist, although I will not go into the details. As for the briefcases and other secure items in which documents are carried, I can reassure my right hon. Friend that it is exceptional for documents to be taken out of the building. Authorisation needs to be sought, and if it is given, it is given only in the most secure circumstances. As I said earlier, it was not sought in this case.

All of us are probably appalled that we have to be here today because of a breach of security on this scale. A tribute has been paid to the BBC for its prompt response, but perhaps we also owe a tribute to the finder of the documents, who could presumably have taken them to some other less responsible parties, perhaps in return for remuneration. Thank goodness the person who laid hands on them had some good sense.

We are all aware that this is not the only loss of information—the leader of my party, my right hon. Friend the Member for Sheffield, Hallam (Mr. Clegg), counted some 37 million pieces of personal data that went missing last year—but I have to say that this is on a different scale and of a different order, and perhaps we should not conflate the two issues.

I noted the slight irony that the Department that the Government have asked to review data-handling procedures is the Cabinet Office. Looking at one’s own home first may, in fact, be an appropriate step.

I have only a few questions to add to those that have already been asked. It is, perhaps, possible to be almost too glibly certain that the documents never passed into the wrong hands, and I hope those conducting the investigation will consider that carefully rather than dismissing what happened as simply chance and accident. Although I think we all overwhelmingly believe that that is what it must have been, any other possibility should not be ruled out at this early stage, and I ask for this possibility not to be mentally dismissed or treated in a trivial way.

Both the BBC and The Guardian have reported that, under strict procedures—the Minister mentioned some of them—officials can take secret documents out. Perhaps we need to know a little more about what those procedures are in order to have an idea of whether or not they made sense in this case. A mere locked box, for example, does not seem terribly appropriate.

The main question that I want to ask, however, is this: to what extent are the procedures fine while the culture is not? A much more casual culture can easily develop, in which someone dumps the contents of an in-tray into a briefcase to read or to work on at home, having lost the sense that certain key documents carry real importance and real concern. At that point, even if all the procedures are in place, if the culture has led to the loss of that sense—and I doubt that this was a one-off; the loss may have been, but I bet the taking home was not—a much more fundamental problem exists, which must be examined.

Let me pick up something that was said by the right hon. Member for Horsham (Mr. Maude). I am anxious that this episode should not become a slur on the civil service as a whole. Presumably, it involved someone who made an error or did something wrong at a—

At a very senior level. We do not need to treat this incident as suggesting that the civil service at large is not conscious of these issues. However, I would like the question of the culture to be thoroughly addressed.

Let me start by associating myself with the hon. Lady’s comments about the civil service. As she says, it is easy in such circumstances to attach general opprobrium to the civil service. That would be wrong, because the vast majority of civil servants not only do a very good job, but do it with a proper regard for information security. It is important to put that on the record.

The hon. Lady made a point about the rules for taking documents out of buildings. Let us be absolutely clear: in this case, there was no authorisation for the documents to be taken out of the building. The rules were absolutely clear: authorisation should be sought. Such documents should be taken out of buildings in the most exceptional circumstances only, and in the securest of briefcases and with other such security attached. As I have said, there was no authorisation in this case, and there was no such security.

The hon. Lady also raised the issue of culture. Let me return to the first point I made: it would be a bit too easy—and also wrong—to say that because one out of 40 or 50 members of the assessment staff took a document out of the building without authorisation, that is a part of a general culture either there or elsewhere. Having said that, however, we want Sir David Omand to look at the necessary procedures and safeguards precisely in order to ensure both that that is not the case and that any necessary safeguards are in place.

I will not follow the Opposition spokesman’s stance of sentence first and trial afterwards, but that does not mean that there are not some serious questions to pose. Although I accept that the Minister will not be able to answer all of them today, I think they should form a part of the Omand investigation. There are top secret documents not only in the JIC and the Cabinet Office, but in other offices across Whitehall. Will the message that classified documents cannot be taken out of a secure environment except under certain conditions be strongly reinforced? Secondly, what explanation is there about the gap between the alleged leaving of the documents on Tuesday morning and the notification to the Cabinet Office on Wednesday morning—will that question be asked? Thirdly, the inquiry must look at the question, which will be in people’s minds, as to whether those documents were taken from the office for the purpose of being leaked.

I am grateful to my right hon. Friend for his contribution. On his first point about classified documents, he is right that we should reinforce that message, and because of the gravity of this incident we are taking steps to do so not only to the assessment staff, but to all staff who handle intelligence-related material. That message is, as we speak, being conveyed by the Cabinet Secretary and other permanent secretaries across Government. My right hon. Friend asked about the timeline. It is for the police investigation to trace exactly what happened, and I think he will understand why I do not want to comment on that. Finally, let me say to my right hon. Friend that there is a need to improve the information security culture. We want Sir David Omand to conduct a review in order to look at questions to do with the security of intelligence-related material, and that is what he will do.

I am rather astonished that no reference has been made to the searching of individuals as they enter and leave premises where top secret material is held. Why should somebody who works in such premises not be searched on leaving premises to check that they are not removing classified material? Is that routinely done, and if so, do people of a sufficient level of seniority think themselves above such procedures?

All issues will, of course, need to be looked at by Sir David Omand. Searching each individual from the assessment staff who leaves the building each evening would clearly be quite an onerous task.

Many of us have been campaigning for many years for more transparency in Government, but this is not what we had in mind. I welcome the Minister’s decision to come to the House so speedily and to set up the inquiry so quickly, given the terms of reference that he has mentioned. Only the most partisan person would feel that he was in any way responsible for what happened: he was not on the train; he was not reading the document; and he did not take the documents out of the relevant Department. Will he undertake to ensure that he has discussions with other colleagues who are most closely involved with these matters? I saw that the Home Secretary was sitting beside him a few moments ago. Has he had discussions with her, and will he ensure that when the inquiry is completed, it will be published—at least those facts that can be put into the public domain—so that we know what the process was and whether it was followed? Also, will he undertake to come back to the House with that report?

I am grateful to my right hon. Friend who takes a great interest in these matters as Chairman of the Home Affairs Committee. He asked about my discussions with other colleagues; I have discussed this matter with the Home Secretary. My right hon. Friend will know that in the past such inquiries have had an element that must remain classified, which is why I mentioned the Intelligence and Security Committee, but I will, of course, keep the House informed of Sir David Omand’s conclusions.

I recognise that such mishaps can occasionally happen. I was in the Foreign Office for five years, and I was aware of—indeed, involved in—occasional lapses of this kind. Incidentally, may I say to my hon. Friend the Member for New Forest, East (Dr. Lewis) that I would not have favoured being searched when I left the Foreign Office. What is important is to learn from these experiences and to try to make improvements, but as my right hon. Friend the Member for Horsham (Mr. Maude) has said there has now been a pattern of failure over many months—there have been many incidents. That suggests to me that the mistakes are not being addressed, despite the many inquiries that have doubtless been set up. Therefore, may I say that it is the business of the right hon. Gentleman and of senior officials to bear down on what I suspect is a very casual attitude that is now being taken with regard to documents of this kind?

I am grateful to the right hon. and learned Gentleman for his comments. He can take up with the hon. Member for New Forest, East whether he would have wanted to have been searched on leaving the Foreign Office. No doubt, Sir David Omand will consider the matter. As for the question about culture, let me make the point that this matter relates to one individual within the assessment staff. Because of the gravity of this issue, we have taken action to remind all the assessment staff and those across Government dealing with such sensitive material about security, and we have asked Sir David Omand to conduct his investigation in order to look at whether more can be done to put the necessary safeguards in place.

Let me say a few words on information security. Regrettably, I would not be being honest if I were to give a guarantee that no such incidents will ever occur. What I can say, however, is that we should take the necessary action and take all the steps we can to prevent them from happening. That is why I have come before the House today.

Is it not a fact that this official was a seconded MI5 officer, and that, therefore, all this business about him being part of the assessment staff is part of an attempt to play this incident down? Although the Minister is innocent of responsibility for this cock-up, he is responsible for addressing the investigation and the remedy. I have no confidence whatever in Sir David Omand; he is a safe pair of hands, and will be involved in a cover-up. Does the Minister recall a conversation I had with him three weeks ago, when I told him there was no parliamentary oversight of the security and intelligence services? He promised to come back to me, but he did not. I reiterate my point: unless or until there is a Committee of Parliament looking into these matters, we can have no confidence about the veracity of the security and intelligence services and the so-called investigations. Let us have a parliamentary Committee now.

My hon. Friend has very strong views about the status of the Intelligence and Security Committee. I recall our discussion, and it will no doubt be a continuing part of his discussions with the Government and those people who are responsible for these decisions.

I am not going to get drawn into a discussion of the status of the individual concerned. Apart from anything else, I do not think that would be fair to that individual. As for my hon. Friend’s comments about Sir David Omand, I met Sir David this morning and he is determined to conduct a rigorous investigation to ensure that, as far as possible, we have the necessary safeguards in place.

I thank the Minister for his statement and for advance notice of it, and for his candour in saying that no authorisation was sought for the removal of the documents and in describing the breaches in guidelines, procedures and rules. In any number of the answers that he has given, he has said that the latter needed to be beefed up. My concern is not about guidelines, but about the fact that there appears to be no physical or technical restriction preventing people from getting documents in the instance of a rule breach. Rules will always be breached, either innocently or out of malice. So, will the Minister assure me that when the Government examine this properly, they will examine not only rules, guidelines and instructions, but physical and technical restrictions that will simply prevent a document from being accessed or handed over when the rules have been breached?

Again, I want to be slightly cautious in what I say about the circumstances of this case, for reasons that the House will understand. When individuals are closely involved in the production of a document, they will clearly have access to it—it is hard to prevent that from happening. The hon. Gentleman made a wider point about Sir David’s review and its examination of what can be done. I am not coming to this place promising magic solutions, and, in a way, we must let Sir David do his work. He is experienced and expert in these matters, so we must allow him to examine what can be done, to make his judgment about the safeguards and the rules that are in place, and to report accordingly.

The security of information, whether electronic or on paper, clearly must be given higher priority by all organisations, both in the public and private sector—recent lapses have also occurred in banks and so on. Sir Edmund Burton was charged with looking at the problem that occurred in the Ministry of Defence when a laptop was left on the back seat of a car. Has my right hon. Friend seen a report from Sir Edmund Burton? Can lessons be learned from that? Can we have a discussion in this House about information assurance in its broader sense—not necessarily in terms of things that are covered by the Official Secrets Act—to convince us that a proper process, led by his Department, is under way that will comfort the public, who are concerned about how the Government handle data?

My hon. Friend obviously has expertise in these matters. First, Sir Edmund Burton is reporting to the Defence Secretary, and that report is a matter for him. More important than that is the broader issue, which relates to the ongoing report by Sir Gus O’Donnell into the wider lessons that we should learn about information assurance. A number of hon. Members on both sides have talked about culture change, and that particular question needs to be addressed in relation to data issues, which have obviously been the subject of much discussion over the past few months. There are also obviously issues to be addressed on the handling of paper documents, as we have discovered in the course of the past 48 hours. My hon. Friend is right to say that these issues need to be taken very seriously by this House and by others.

It is obviously a good thing that the Minister for the Cabinet Office has chosen to make this statement, but may I explore when and for what reasons he decided to do so? Was it his decision to make a statement or was it the Prime Minister’s? For what reason has the statement been made? Is it because the document went missing? Is it because it was returned? Or is it because it was publicised by the BBC?

It was my decision—a decision with which the Prime Minister agreed. I think that this is a serious matter, and it is right that I inform the House about what I know of the circumstances and about the action that I plan to take.

I declare a constituency interest and, indeed, a past family connection. Does the Minister agree that members of the British Secret Intelligence Service have had an exemplary record of care and confidentiality over a century of service to this country? Does he also agree that the Conservative Front-Bench spokesman’s loose language of “low morale” and “laxity” was profoundly inappropriate? Does he also agree that it is vital that responsibility is taken, that current procedures are enforced, and, if necessary, reviewed further, and that our Secret Intelligence Service is not denigrated by party political point scoring?

I associate myself with the hon. Gentleman’s remarks about the civil service. It is one of the jobs of the Opposition to pounce on situations where there is human fallibility and where human mistakes are made and make them a party political issue. That is part of our political culture, and I would not expect anything else of the Opposition Front-Bench team. I believe that when most Members of this House, including the right hon. Member for Horsham (Mr. Maude), think about this issue, they will want to associate themselves with the remarks that the hon. Gentleman makes about members of the intelligence services, the vast majority of whom do an incredibly important job for our country.

I was very disappointed by the remarks made by the hon. Member for Cheltenham (Martin Horwood); he did himself a disservice. I know that my right hon. Friend the Member for Horsham (Mr. Maude) has gone on record praising this nation’s security services, so we should let the record stand.

Is the Minister completely confident that the BBC or the passenger did not take further copies of these documents? Given the Government’s shambolic record on data security and managing risk, is it not time that they perhaps tried to manage reward and give incentives for people who return Government property? I am thinking of things such as the 1,000 laptops that have gone missing in recent years.

On the hon. Gentleman’s first question, all those matters are for the police investigation and I shall not comment on them, for reasons that he will understand. Obviously, we will think further about the question of rewards.